Cyber Incident Victim: Landesregierung Mecklenburg-Vorpommern
Date:
Apr 2023
Location:
Germany
Summary
The Landesregierung Mecklenburg-Vorpommern reported that its websites, including ministry pages, the police homepage and the MV‑Serviceportal, were temporarily unreachable after a surge of requests identified as a distributed denial‑of‑service attack. The state’s IT service provider DVZ and its CERT M‑V team traced the traffic to a Russian cyber group that claimed responsibility on social media, blocked the offending sources and implemented additional defenses. While the police intranet remained operational, the online police reporting desk was temporarily unavailable, though emergency telephone services and on‑site police stations continued to function normally.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On the morning of April 4, 2023, the IT specialists of the Datenverarbeitungszentrum M-V and the state's computer emergency response team CERT M-V observed a sharp rise in requests to the government portal's websites. Initial analysis indicated that the surge was caused by a distributed denial‑of‑service attack intended to overload the servers with massive traffic. The affected services included the websites of several state ministries, the public homepage of the Landespolizei, and the MV‑Serviceportal, all of which are hosted and maintained by the DVZ M-V. State digitalization minister Christian Pegel confirmed the incident and announced the formation of a task force.
The task force promptly notified the Bundesamt für Sicherheit in der Informationstechnik (BSI) about the ongoing attack. CERT M-V specialists worked to identify the source of the traffic, successfully blocking early attacker IP addresses and deploying additional technical defenses to mitigate further waves. According to the current status report from CERT, a Russian cyber‑group claimed responsibility for the attack on social‑media channels. These actions were undertaken to restore availability and prevent subsequent disruption.
While the public‑facing websites were intermittently unreachable, the interior ministry stated that the police intranet, which handles all internal police operations, remained unaffected by the attack. Consequently, the Landespolizei continued to operate normally at its stations and via telephone, although its online watch for filing reports was temporarily unavailable. For emergencies, the public was advised to continue using the emergency number 110. The narrative ends here.